From owner-svn-src-all@FreeBSD.ORG Thu Oct 30 10:13:53 2008 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6CBD51065698; Thu, 30 Oct 2008 10:13:53 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 573A28FC68; Thu, 30 Oct 2008 10:13:53 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id m9UADrZ3047731; Thu, 30 Oct 2008 10:13:53 GMT (envelope-from rwatson@svn.freebsd.org) Received: (from rwatson@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id m9UADrQ6047728; Thu, 30 Oct 2008 10:13:53 GMT (envelope-from rwatson@svn.freebsd.org) Message-Id: <200810301013.m9UADrQ6047728@svn.freebsd.org> From: Robert Watson Date: Thu, 30 Oct 2008 10:13:53 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r184467 - head/sys/security/mac_bsdextended X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2008 10:13:53 -0000 Author: rwatson Date: Thu Oct 30 10:13:53 2008 New Revision: 184467 URL: http://svn.freebsd.org/changeset/base/184467 Log: The V* flags passed using an accmode_t to the access() and open() access control checks in mac_bsdextended are not in the same namespace as the MBI_ flags used in ugidfw policies, so add an explicit conversion routine to get from one to the other. Obtained from: TrustedBSD Project Modified: head/sys/security/mac_bsdextended/mac_bsdextended.c head/sys/security/mac_bsdextended/ugidfw_internal.h head/sys/security/mac_bsdextended/ugidfw_vnode.c Modified: head/sys/security/mac_bsdextended/mac_bsdextended.c ============================================================================== --- head/sys/security/mac_bsdextended/mac_bsdextended.c Thu Oct 30 08:32:18 2008 (r184466) +++ head/sys/security/mac_bsdextended/mac_bsdextended.c Thu Oct 30 10:13:53 2008 (r184467) @@ -1,5 +1,5 @@ /*- - * Copyright (c) 1999-2002, 2007 Robert N. M. Watson + * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. * Copyright (c) 2005 Tom Rhodes * Copyright (c) 2006 SPARTA, Inc. @@ -465,6 +465,27 @@ ugidfw_check_vp(struct ucred *cred, stru return (ugidfw_check(cred, vp, &vap, acc_mode)); } +int +ugidfw_accmode2mbi(accmode_t accmode) +{ + int mbi; + + mbi = 0; + if (accmode & VEXEC) + mbi |= MBI_EXEC; + if (accmode & VWRITE) + mbi |= MBI_WRITE; + if (accmode & VREAD) + mbi |= MBI_READ; + if (accmode & VADMIN) + mbi |= MBI_ADMIN; + if (accmode & VSTAT) + mbi |= MBI_STAT; + if (accmode & VAPPEND) + mbi |= MBI_APPEND; + return (mbi); +} + static struct mac_policy_ops ugidfw_ops = { .mpo_destroy = ugidfw_destroy, Modified: head/sys/security/mac_bsdextended/ugidfw_internal.h ============================================================================== --- head/sys/security/mac_bsdextended/ugidfw_internal.h Thu Oct 30 08:32:18 2008 (r184466) +++ head/sys/security/mac_bsdextended/ugidfw_internal.h Thu Oct 30 10:13:53 2008 (r184467) @@ -34,6 +34,7 @@ /* * Central access control routines used by object-specific checks. */ +int ugidfw_accmode2mbi(accmode_t accmode); int ugidfw_check(struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode); int ugidfw_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode); Modified: head/sys/security/mac_bsdextended/ugidfw_vnode.c ============================================================================== --- head/sys/security/mac_bsdextended/ugidfw_vnode.c Thu Oct 30 08:32:18 2008 (r184466) +++ head/sys/security/mac_bsdextended/ugidfw_vnode.c Thu Oct 30 10:13:53 2008 (r184467) @@ -1,5 +1,5 @@ /*- - * Copyright (c) 1999-2002, 2007 Robert N. M. Watson + * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. * Copyright (c) 2005 Tom Rhodes * Copyright (c) 2006 SPARTA, Inc. @@ -65,11 +65,7 @@ ugidfw_vnode_check_access(struct ucred * struct label *vplabel, accmode_t accmode) { - /* - * XXX: We pass accmode_t variable containing V* constants - * as an int containing MBI_* constants. - */ - return (ugidfw_check_vp(cred, vp, (int)accmode)); + return (ugidfw_check_vp(cred, vp, ugidfw_accmode2mbi(accmode))); } int @@ -175,11 +171,7 @@ ugidfw_vnode_check_open(struct ucred *cr struct label *vplabel, accmode_t accmode) { - /* - * XXX: We pass accmode_t variable containing V* constants - * as an int containing MBI_* constants. - */ - return (ugidfw_check_vp(cred, vp, (int)accmode)); + return (ugidfw_check_vp(cred, vp, ugidfw_accmode2mbi(accmode))); } int